3 ms·
The point of the integrity hash is to be able to include a remote resource after reviewing and verifying it, and then being sure it doesn't change to do other t
by capableweb 3y ago
The point of the integrity hash is to be able to include a remote resource after reviewing and verifying it, and then being sure it doesn't change to do other things automagically, that you haven't reviewed before it runs on your users browser.
Wrapping the script tag in a iframe does not accomplish this as far as I can tell.
- bhouston 3y agoRight. But the main attack vector of a raw JavaScript include into the main page is that it can access anything you are doing in that page include logins or secrets or cookies or other private data. Moving it into an iframe sandboxes it and reduces the majority of nefarious things it can do. Especially if it is running off of web3dsurvey in the iframe and not the host website origin - thus a bunch of cross origin protections kick in. So the iframe sandbox deals with the security issue is a different fashion. Also the iframe can not block the main pages so it has even less impact on the main page experience. This is as secure now as the majority of ads served on the web.